Hi, I have type a "shorewall (4.5.4) drop x.x.x.x", an malware IP that
constantly tried to access my DNS, but the IP was not blocked
immediately.
> -A dynamic -s x.x.x.x/32 -j DROP
> ....
> -A INPUT -i eth1 -j net2fw
> -A net2fw -m conntrack --ctstate INVALID,NEW -j dynamic
> -A net2fw -p tcp -j tcpflags
> -A net2fw -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
> -A net2fw -p udp -m udp --dport 1194 -j ACCEPT
> -A net2fw -d y.y.y.y/32 -p icmp -m icmp --icmp-type 8 -j ACCEPT
> -A net2fw -d y.y.y.y/32 -p tcp -m tcp --dport 22 -j ACCEPT
> -A net2fw -d y.y.y.y/32 -p tcp -m multiport --dports 80,443 -j ACCEPT
> -A net2fw ! -s x.x.x.x/32 -d y.y.y.y/32 -p tcp -m tcp --dport 53 -j ACCEPT
> -A net2fw ! -s x.x.x.x/32 -d y.y.y.y/32 -p udp -m udp --dport 53 -j ACCEPT
This probably happens because the connection is always active:
> # shorewall show connections |grep x.x.x.x
> ipv4 2 udp 17 178 src=x.x.x.x dst=y.y.y.y sport=80 dport=53
src=y.y.y.y dst=x.x.x.x sport=53 dport=80 [ASSURED] mark=0 secmark=0 use=2
>
and the rule "dynamic" is applies only to new connections
"conntrack
--ctstate INVALID,NEW"
In addition, the rule:
"-A net2fw -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
makes the connection to be accepted without meeting the rule would not
allow access to DNS:
"-A net2fw ! -s x.x.x.x/32 -d y.y.y.y/32 -p udp -m udp --dport 53 -j
ACCEPT"
What am I doing wrong?
It''s possible, after a shorewall drop IP, delete the alive connection
for the dropped IP?
Many thanks for reply
--
Dario Lesca - sip:dario@solinos.it
(Inviato dal mio Fedora Linux)
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today''s security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/